{"id":13564495,"url":"https://github.com/greenpau/cni-plugins","last_synced_at":"2025-03-15T14:30:39.037Z","repository":{"id":47667334,"uuid":"285019493","full_name":"greenpau/cni-plugins","owner":"greenpau","description":"CNI Plugins compatible with nftables","archived":false,"fork":false,"pushed_at":"2024-05-11T13:37:53.000Z","size":181,"stargazers_count":44,"open_issues_count":2,"forks_count":13,"subscribers_count":7,"default_branch":"main","last_synced_at":"2024-05-23T02:03:20.999Z","etag":null,"topics":["cni","cni-plugin","cni-plugins","firewall","nftables","podman"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/greenpau.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-04T15:22:07.000Z","updated_at":"2024-05-28T03:21:20.711Z","dependencies_parsed_at":"2024-05-11T14:50:14.213Z","dependency_job_id":null,"html_url":"https://github.com/greenpau/cni-plugins","commit_stats":{"total_commits":79,"total_committers":6,"mean_commits":"13.166666666666666","dds":"0.16455696202531644","last_synced_commit":"f47675e0560ee03409f3ce5a0893bf49bdd9faca"},"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/greenpau%2Fcni-plugins","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/greenpau%2Fcni-plugins/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/greenpau%2Fcni-plugins/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/greenpau%2Fcni-plugins/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/greenpau","download_url":"https://codeload.github.com/greenpau/cni-plugins/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243715306,"owners_count":20335899,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cni","cni-plugin","cni-plugins","firewall","nftables","podman"],"created_at":"2024-08-01T13:01:32.174Z","updated_at":"2025-03-15T14:30:39.006Z","avatar_url":"https://github.com/greenpau.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# CNI Plugins compatible with nftables\n\n\u003ca href=\"https://github.com/greenpau/cni-plugins/actions/\" target=\"_blank\"\u003e\u003cimg src=\"https://github.com/greenpau/cni-plugins/workflows/build/badge.svg?branch=main\"\u003e\u003c/a\u003e\n\u003ca href=\"https://pkg.go.dev/github.com/greenpau/cni-plugins\" target=\"_blank\"\u003e\u003cimg src=\"https://img.shields.io/badge/godoc-reference-blue.svg\"\u003e\u003c/a\u003e\n![License](https://img.shields.io/github/license/greenpau/cni-plugins)\n\nThe plugins in this repository implement\n[CNI Specification v0.4.0](https://github.com/containernetworking/cni/blob/spec-v0.4.0/SPEC.md).\n\nAt the moment, the [CNI Plugins](https://github.com/containernetworking/plugins)\nmaintained by the CNI team do not support `nftables`. The below plugins do.\n\nThis repository contains the following plugins:\n\n* `cni-nftables-portmap`: port mapping with `nftables`\n* `cni-nftables-firewall`: firewalling with `nftables`\n\n\u003c!-- begin-markdown-toc --\u003e\n## Table of Contents\n\n- [CNI Plugins compatible with nftables](#cni-plugins-compatible-with-nftables)\n  - [Table of Contents](#table-of-contents)\n  - [Supported Operating Systems](#supported-operating-systems)\n  - [Getting Started](#getting-started)\n  - [Architecture](#architecture)\n  - [Miscellaneous](#miscellaneous)\n    - [Known Issues](#known-issues)\n\n\u003c!-- end-markdown-toc --\u003e\n\n## Supported Operating Systems\n\nThe plugins had been tested on the following systems:\n\n* CentOS 8:\n  - kernel version: `4.18.0-193.14.2.el8_2.x86_64`\n  - nftables version `v0.9.3 (Topsy)`\n\n## Getting Started\n\nFirst, download the plugins:\n\n```bash\ngo install github.com/greenpau/cni-plugins/cmd/cni-nftables-portmap@latest\ngo install github.com/greenpau/cni-plugins/cmd/cni-nftables-firewall@latest\n```\n\nCheck the location of the downloaded plugins:\n\n```\n$ which cni-nftables-portmap\n~/dev/go/bin/cni-nftables-portmap\n```\n\nNext, copy the plugins to `/usr/local/lib/cni/` directory.\n\n```bash\nmv ~/dev/go/bin/cni-nftables-{portmap,firewall} /usr/local/lib/cni/\n```\n\nAfter the above, copy `assets/net.d/87-podman-bridge.conflist` to\n`/etc/cni/net.d/`.\n\n```bash\nsudo cp assets/net.d/87-podman-bridge.conflist /etc/cni/net.d/\n```\n\nThe configuration is as follows:\n\n```json\n{\n  \"cniVersion\": \"0.4.0\",\n  \"name\": \"podman\",\n  \"plugins\": [\n    {\n      \"type\": \"bridge\",\n      \"bridge\": \"cni-podman0\",\n      \"isGateway\": true,\n      \"ipMasq\": false,\n      \"ipam\": {\n        \"type\": \"host-local\",\n        \"routes\": [\n          {\n            \"dst\": \"0.0.0.0/0\"\n          }\n        ],\n        \"ranges\": [\n          [\n            {\n              \"subnet\": \"10.88.0.0/16\",\n              \"gateway\": \"10.88.0.1\"\n            }\n          ]\n        ]\n      }\n    },\n    {\n      \"type\": \"cni-nftables-portmap\",\n      \"capabilities\": {\n        \"portMappings\": true\n      }\n    },\n    {\n      \"type\": \"cni-nftables-firewall\",\n      \"forward_chain_name\": \"forward\"\n    }\n  ]\n}\n```\n\nPlease note the `ipMasq` key is being set to `false`.\n\nReview network config:\n\n```bash\n$ sudo podman network ls\nNAME     VERSION   PLUGINS\npodman   0.4.0     bridge,cni-nftables-portmap,cni-nftables-firewall\n```\n\nNext, run the following command to place a container in the previously\ncreated `podman` network and query AWS Check IP website:\n\n```bash\npodman run --net=podman -it nicolaka/netshoot curl http://checkip.amazonaws.com/\n```\n\nRun the following commands to test port-mapping plugin by placing\na container in `podman` network and exposing a web server in\nthe container.\n\nFirst, start the container:\n\n```bash\npodman run --net=podman -P -d nginxdemos/hello\n```\n\nAlternatively, map the container port to port `8080`:\n\n```bash\npodman run --net=podman -p 8080:80/tcp -d nginxdemos/hello\n```\n\nVerify connectivity to the container:\n\n```bash\ncurl -v http://HOST_IP:8080\n```\n\nFor localhost port mapping to work it is necessary to set route_localnet sysctl\n```bash\nsysctl -w net.ipv4.conf.all.route_localnet=1\n```\n\nAlso, don't limit your sending and receiving of 127.0.0.1 to the `lo`\ninterface.\n\n```\nnft add rule filter input iifname != 'lo' ip saddr 127.0.0.0/8 counter drop\nnft add rule filter input iifname != 'lo' ip daddr 127.0.0.0/8 counter drop\n```\n\nThis will block communication between the localhost and the container\nnetwork. Instead, match the physical interfaces explicitly, like this.\n\n```\nnft add rule filter input iifname eth0 ip saddr 127.0.0.0/8 counter drop\nnft add rule filter input iifname eth0 ip daddr 127.0.0.0/8 counter drop\nnft add rule filter input iifname eth1 ip saddr 127.0.0.0/8 counter drop\nnft add rule filter input iifname eth1 ip daddr 127.0.0.0/8 counter drop\n```\n\nThis allows the container network to communicate with localhost.\n\n\n## Architecture\n\nTBD.\n\n## Miscellaneous\n\n### Known Issues\n\nThere could be an issue with checksums when using `portmap` plugin.\n\nSpecifically, packets would arrive to a container, but they would be\ndisregarded and no `SYN/ACK` would be sent.\n\nWhen running `tcpdump` inside a container, there is checksum error\n`cksum 0xd776 (incorrect -\u003e 0xd8b9)`.\n\n```\n$ tcpdump -i eth0 -vvv -nne\ntcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes\n01:05:16.704789 ee:58:3f:4d:1f:23 \u003e ea:56:b4:c6:4f:c7, ethertype IPv4 (0x0800), length 58: (tos 0x0, ttl 63, id 8844, offset 0, flags [none], proto TCP (6), length 44)\n    10.0.2.2.54017 \u003e 10.88.0.116.80: Flags [S], cksum 0xd776 (incorrect -\u003e 0xd8b9), seq 2337032705, win 65535, options [mss 1460], length 0\n```\n\nSee similar issue\n[here](https://stackoverflow.com/questions/26716722/tcp-receives-packets-but-it-ignores-them).\n\nThe solution is upgrading to nftables v0.9.3 (Topsy).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgreenpau%2Fcni-plugins","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgreenpau%2Fcni-plugins","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgreenpau%2Fcni-plugins/lists"}